Fix today

A file with your site's passwords is downloadable

This is the exact wording EverThread uses when it finds this on a customer's site, written for someone who runs a business, not a server. The example site here is yourbakery.com.

What we saw

https://yourbakery.com/.env is publicly readable. These files usually hold database passwords and API keys.

Why it matters

Anyone who finds it has the keys to your database and connected services. Treat every secret in it as already leaked.

How to fix it

Tell your developer immediately: block the file, then change every password and key inside it.

For your developer